Exploring sensor usage behaviors of Android applications based on data flow analysis

摘要

Today's Android-powered smartphones are equipped with various embedded sensors, such as the motion sensors, the environmental sensors and the position sensors. Many functions in the third-party applications (apps) need to use these sensors. However, embedded sensors may lead to security issues, as the third-party apps can access data from these sensors without claiming any permissions. It has been proven that embedded sensors can be exploited by well designed malicious apps, resulting in leaking users' privacy. In this work, we are motivated to provide an up-to-date overview of sensor usage patterns in current apps by investigating what, why and how embedded sensors are used in all the apps collected from a complete app market. To fulfill this goal, We develop a tool called ???SDFDroid??? to identify the sensors' types and to generate the sensor data propagation paths in each app. We then cluster the apps to find out their sensor usage patterns based on their sensor data propagation paths. We apply our method on AppChina, a widely used Chinese Android app market. Extensive experiments are conducted and the experimental results show that most apps implement their sensor related functions by using the third-party libraries. We further study the sensor usage in the third-party libraries. Our results show the accelerometer sensor is the most frequently used sensor. Though many third-party libraries use no more than four types of sensors, there are some third-party libraries register all the types of sensors recklessly. These results show the need for better regulating the sensor usage in Android apps.